Trying ports that it shouldn't be.

Sep 13 23:32:38 master sshd[24440]: Failed password for root from 104.244.74.11 port 40654 ssh2
Sep 13 23:32:40 master sshd[24442]: Failed password for root from 104.244.74.11 port 43056 ssh2
Sep 13 23:32:43 master sshd[24444]: Failed password for root from 104.244.74.11 port 44768 ssh2
Sep 13 23:32:46 master sshd[24446]: Failed password for root from 104.244.74.11 port 46854 ssh2
Sep 13 23:32:49 master sshd[24448]: Failed password for invalid user admin from 104.244.74.11 port 48958 ssh2
Sep 13 23:32:52 master sshd[24450]: Failed password for invalid user admin from 104.244.74.11 port 50988 ssh2
Sep 13 23:32:55 master sshd[24452]: Failed password for invalid user admin from 104.244.74.11 port 53590 ssh2
Sep 13 23:32:57 master sshd[24454]: Failed password for invalid user test from 104.244.74.11 port 55668 ssh2
Sep 13 23:33:00 master sshd[24456]: Failed password for invalid user pi from 104.244.74.11 port 57072 ssh2
Sep 13 23:33:03 master sshd[24458]: Failed password for invalid user support from 104.244.74.1

Trying ports that it shouldn't be.

Automatic report - Port Scan Attack

2019-08-26T02:14:59.755591enmeeting.mahidol.ac.th sshd\[20021\]: User root from 104.244.74.11 not allowed because not listed in AllowUsers
2019-08-26T02:14:59.878460enmeeting.mahidol.ac.th sshd\[20021\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.11  user=root
2019-08-26T02:15:01.974838enmeeting.mahidol.ac.th sshd\[20021\]: Failed password for invalid user root from 104.244.74.11 port 40484 ssh2
...

Sep 26 22:41:53 OPSO sshd\[7410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.223  user=root
Sep 26 22:41:55 OPSO sshd\[7410\]: Failed password for root from 104.244.74.223 port 39220 ssh2
Sep 26 22:41:55 OPSO sshd\[7412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.223  user=admin
Sep 26 22:41:57 OPSO sshd\[7412\]: Failed password for admin from 104.244.74.223 port 41022 ssh2
Sep 26 22:41:58 OPSO sshd\[7416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.223  user=root

 TCP (SYN) 104.244.74.223:36692 -> port 22, len 48

Sep 20 03:44:25 propaganda sshd[23022]: Connection from 104.244.74.28 port 55042 on 10.0.0.161 port 22 rdomain ""
Sep 20 03:44:26 propaganda sshd[23022]: Invalid user admin from 104.244.74.28 port 55042

2020-09-20T07:27:05+0200 Failed SSH Authentication/Brute Force Attack. (Server 5)

Invalid user admin from 104.244.74.223 port 46624

2020-09-19T08:12:51.934191dmca.cloudsearch.cf sshd[7343]: Invalid user admin from 104.244.74.223 port 47402
2020-09-19T08:12:51.939421dmca.cloudsearch.cf sshd[7343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.223
2020-09-19T08:12:51.934191dmca.cloudsearch.cf sshd[7343]: Invalid user admin from 104.244.74.223 port 47402
2020-09-19T08:12:54.215542dmca.cloudsearch.cf sshd[7343]: Failed password for invalid user admin from 104.244.74.223 port 47402 ssh2
2020-09-19T08:12:54.447796dmca.cloudsearch.cf sshd[7345]: Invalid user admin from 104.244.74.223 port 48650
2020-09-19T08:12:54.452658dmca.cloudsearch.cf sshd[7345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.223
2020-09-19T08:12:54.447796dmca.cloudsearch.cf sshd[7345]: Invalid user admin from 104.244.74.223 port 48650
2020-09-19T08:12:56.472965dmca.cloudsearch.cf sshd[7345]: Failed password for invalid user admin from 104.244.74.
...

Connection to SSH Honeypot - Detected by HoneypotDB

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-16T07:33:31Z and 2020-09-16T07:33:34Z

Sep 16 01:50:12 mail sshd[32693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.169
Sep 16 01:50:14 mail sshd[32693]: Failed password for invalid user admin from 104.244.74.169 port 58212 ssh2
...

Sep 13 19:00:51 serwer sshd\[26735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.169  user=root
Sep 13 19:00:53 serwer sshd\[26735\]: Failed password for root from 104.244.74.169 port 48976 ssh2
Sep 13 19:00:56 serwer sshd\[26735\]: Failed password for root from 104.244.74.169 port 48976 ssh2
...

(sshd) Failed SSH login from 104.244.74.169 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 13 08:14:27 amsweb01 sshd[11989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.74.169  user=root
Sep 13 08:14:28 amsweb01 sshd[11989]: Failed password for root from 104.244.74.169 port 38474 ssh2
Sep 13 08:14:31 amsweb01 sshd[11989]: Failed password for root from 104.244.74.169 port 38474 ssh2
Sep 13 08:14:33 amsweb01 sshd[11989]: Failed password for root from 104.244.74.169 port 38474 ssh2
Sep 13 08:14:35 amsweb01 sshd[11989]: Failed password for root from 104.244.74.169 port 38474 ssh2

SSH Brute Force

2020-09-11T05:52:23.133475server.espacesoutien.com sshd[3375]: Failed password for root from 104.244.74.169 port 55944 ssh2
2020-09-11T05:52:25.662921server.espacesoutien.com sshd[3375]: Failed password for root from 104.244.74.169 port 55944 ssh2
2020-09-11T05:52:27.816712server.espacesoutien.com sshd[3375]: Failed password for root from 104.244.74.169 port 55944 ssh2
2020-09-11T05:52:30.466976server.espacesoutien.com sshd[3375]: Failed password for root from 104.244.74.169 port 55944 ssh2
...

Dear user,
 
The IP address [104.244.74.169] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Wed Sep  9 15:40:51 2020.
 
From AstroParrotsNAS

(sshd) Failed SSH login from 104.244.74.57 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  9 00:10:33 server4 sshd[17193]: Failed password for root from 104.244.74.57 port 59308 ssh2
Sep  9 00:10:36 server4 sshd[17193]: Failed password for root from 104.244.74.57 port 59308 ssh2
Sep  9 00:10:38 server4 sshd[17193]: Failed password for root from 104.244.74.57 port 59308 ssh2
Sep  9 00:10:41 server4 sshd[17193]: Failed password for root from 104.244.74.57 port 59308 ssh2
Sep  9 00:10:44 server4 sshd[17193]: Failed password for root from 104.244.74.57 port 59308 ssh2

SSH bruteforce

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/95.54.14.50/ 
 
 RU - 1H : (197)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : RU 
 NAME ASN : ASN12389 
 
 IP : 95.54.14.50 
 
 CIDR : 95.54.0.0/18 
 
 PREFIX COUNT : 2741 
 
 UNIQUE IP COUNT : 8699648 
 
 
 ATTACKS DETECTED ASN12389 :  
  1H - 3 
  3H - 9 
  6H - 21 
 12H - 48 
 24H - 111 
 
 DateTime : 2019-10-28 04:46:27 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

2019-10-28T04:26:50.4283401495-001 sshd\[7424\]: Failed password for invalid user jenghan from 112.161.203.170 port 51152 ssh2
2019-10-28T05:39:48.2537551495-001 sshd\[10513\]: Invalid user user1 from 112.161.203.170 port 58832
2019-10-28T05:39:48.2567991495-001 sshd\[10513\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.161.203.170
2019-10-28T05:39:50.6965861495-001 sshd\[10513\]: Failed password for invalid user user1 from 112.161.203.170 port 58832 ssh2
2019-10-28T05:53:43.1971141495-001 sshd\[11053\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.161.203.170  user=root
2019-10-28T05:53:45.6038181495-001 sshd\[11053\]: Failed password for root from 112.161.203.170 port 56346 ssh2
...

Oct 28 11:14:37 vpn01 sshd[30700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.131.231.210
Oct 28 11:14:39 vpn01 sshd[30700]: Failed password for invalid user r3dh@t from 202.131.231.210 port 45500 ssh2
...

2019-10-28T08:40:40.263416abusebot-2.cloudsearch.cf sshd\[30850\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.113.142.197  user=root

Oct 28 05:05:30 DNS-2 sshd[5760]: Invalid user otto from 115.94.140.243 port 39430
Oct 28 05:05:30 DNS-2 sshd[5760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.94.140.243 
Oct 28 05:05:32 DNS-2 sshd[5760]: Failed password for invalid user otto from 115.94.140.243 port 39430 ssh2
Oct 28 05:05:33 DNS-2 sshd[5760]: Received disconnect from 115.94.140.243 port 39430:11: Bye Bye [preauth]
Oct 28 05:05:33 DNS-2 sshd[5760]: Disconnected from invalid user otto 115.94.140.243 port 39430 [preauth]
Oct 28 05:27:56 DNS-2 sshd[6948]: User r.r from 115.94.140.243 not allowed because not listed in AllowUsers
Oct 28 05:27:56 DNS-2 sshd[6948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.94.140.243  user=r.r
Oct 28 05:27:58 DNS-2 sshd[6948]: Failed password for invalid user r.r from 115.94.140.243 port 42954 ssh2
Oct 28 05:27:58 DNS-2 sshd[6948]: Received disconnect from 115.94.140.243 port 4........
-------------------------------

Oct 28 06:39:04 ny01 sshd[19142]: Failed password for root from 222.186.175.154 port 8272 ssh2
Oct 28 06:39:20 ny01 sshd[19142]: error: maximum authentication attempts exceeded for root from 222.186.175.154 port 8272 ssh2 [preauth]
Oct 28 06:39:31 ny01 sshd[19176]: Failed password for root from 222.186.175.154 port 12386 ssh2

2019-10-28T10:29:45.289190abusebot-4.cloudsearch.cf sshd\[20861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.142.52  user=root

SSH Bruteforce attack

2019-10-18T01:34:34.546412ns525875 sshd\[19263\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.208.27  user=root
2019-10-18T01:34:36.528347ns525875 sshd\[19263\]: Failed password for root from 106.12.208.27 port 57951 ssh2
2019-10-18T01:39:17.663784ns525875 sshd\[24924\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.208.27  user=root
2019-10-18T01:39:20.162622ns525875 sshd\[24924\]: Failed password for root from 106.12.208.27 port 47570 ssh2
2019-10-18T01:44:06.208082ns525875 sshd\[30647\]: Invalid user tq from 106.12.208.27 port 37191
2019-10-18T01:44:06.211664ns525875 sshd\[30647\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.208.27
2019-10-18T01:44:08.720100ns525875 sshd\[30647\]: Failed password for invalid user tq from 106.12.208.27 port 37191 ssh2
2019-10-18T01:48:53.424863ns525875 sshd\[4013\]: pam_unix\(sshd:auth\): auth
...

Oct 28 03:39:10 mailserver sshd[605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.128.97  user=r.r
Oct 28 03:39:12 mailserver sshd[605]: Failed password for r.r from 139.59.128.97 port 42704 ssh2
Oct 28 03:39:12 mailserver sshd[605]: Received disconnect from 139.59.128.97 port 42704:11: Bye Bye [preauth]
Oct 28 03:39:12 mailserver sshd[605]: Disconnected from 139.59.128.97 port 42704 [preauth]
Oct 28 03:49:59 mailserver sshd[1252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.128.97  user=r.r
Oct 28 03:50:00 mailserver sshd[1252]: Failed password for r.r from 139.59.128.97 port 36134 ssh2
Oct 28 03:50:00 mailserver sshd[1252]: Received disconnect from 139.59.128.97 port 36134:11: Bye Bye [preauth]
Oct 28 03:50:00 mailserver sshd[1252]: Disconnected from 139.59.128.97 port 36134 [preauth]
Oct 28 03:55:35 mailserver sshd[1603]: pam_unix(sshd:auth): authentication failure; ........
-------------------------------

Oct 28 16:27:27 itv-usvr-01 sshd[26202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.84.166.140  user=root
Oct 28 16:27:30 itv-usvr-01 sshd[26202]: Failed password for root from 27.84.166.140 port 52136 ssh2
Oct 28 16:31:18 itv-usvr-01 sshd[26359]: Invalid user marilia from 27.84.166.140
Oct 28 16:31:18 itv-usvr-01 sshd[26359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.84.166.140
Oct 28 16:31:18 itv-usvr-01 sshd[26359]: Invalid user marilia from 27.84.166.140
Oct 28 16:31:20 itv-usvr-01 sshd[26359]: Failed password for invalid user marilia from 27.84.166.140 port 33168 ssh2

2019-10-28T06:53:09.941957abusebot-5.cloudsearch.cf sshd\[13564\]: Invalid user cen from 173.162.229.10 port 60700

Oct 28 07:03:23 firewall sshd[30452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.208.162.115
Oct 28 07:03:23 firewall sshd[30452]: Invalid user dzhu from 82.208.162.115
Oct 28 07:03:25 firewall sshd[30452]: Failed password for invalid user dzhu from 82.208.162.115 port 60698 ssh2
...

SSH Bruteforce